This howto is for those people who are unable to root their Galaxy Tab using any of the automated procedures and do not suffer from CLPS (command-line-phobia-syndrome).
My story: After upgrading my EURO (GSM) Galaxy Tab to JM6 my persistent efforts to root the device using either the z4root or SuperOnClick methods have all been unsuccessful. z4root (v1.3.0) kept crashing at different stages, apparently depending on which and how many background apps were running. With SuperOneClick I never managed to get beyond the "changing permissions" stage.
Since both methods are basically wrappers of the rageagainstthecage application, I tried to perform the rooting procedure manually. Guess what, that worked without any problem and it is pretty easy to do.
The basic steps of the rooting process are:
1) use rageagainstthecage to get a temporary root shell
2) use the temporary root shell to copy three files to the read-only system partition the device
While I find the outlined procedure straightforward, you may not. Anyhow, try this at your own risk.
==== Prerequisites ====
I used Ubuntu 10.10 for this, but it should work on any other distro and on Windows just as well. Whatever OS you use, you need a working adb connection to your Galaxy Tab. Odin or Kies are of no use here.
You need the following binaries
* su
* busybox
* Superuser.apk
* rageagainstthecage
To get the all required files, simply download "SuperOneClickv1.5.5-ShortFuse.zip". That's what I used.
Get it here: http://forum.xda-developers.com/showthread.php?t=803682
Extract the contents of the ZIP, open a command-prompt on your computer and change to the directory where the extracted files are located.
Some advice if shell commands are not your regular cup of tea.
The following instructions show the shell commands. Some are executed on the host computer. Others are executed on the Galaxy Tab. You can differentiate between the two easily: All commands which start with "> " need to be executed in a shell on the host computer. Commands which are prefixed with "$ " are executed on the Galaxy Tab. In both case the ">" and the "$" must not be typed. If you copy+paste from this howto, make sure only to copy the commands and leave out the prompt.
==== Step 1: getting a temporary root shell ====
Copy the rageagainstthecage exploit to a temporary directory.
Code:
> adb push rageagainstthecage /data/local/tmp
263 KB/s (5392 bytes in 0.020s)
Change the file permissions and execute the exploit.
Code:
> adb shell
$ cd /data/local/tmp
$ chmod 777 rageagainstthecage
$ ./rageagainstthecage
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C
(other output truncated)
Your shell session will be terminated which will throw you back to the regular command prompt of your host computer.
==== Step 2: restart adb server ====
Now stop and restart the adb server process.
Code:
> adb kill-server
> adb start-server
* daemon not running. starting it now *
* daemon started successfully *
Now reconnect to the Galaxy Tab again. Notice the '#' prompt. This means you have a temporary root shell now. We use this to execute some privileged commands which make the rooting permanent.
==== Step 3: making it permanent ====
First, make the system partition writeable. We need this to be able to copy su, busybox and Superuser.apk to the required locations. Then exit the android shell again.
Code:
> adb shell
# mount -o remount,rw -t rfs /dev/block/stl9 /system
# exit
Now we push busybox and su via adb. Then we install Superuser.apk.
Code:
> adb push busybox /system/bin
> adb push su /system/bin
> adb install Superuser.apk
The final steps are to change the file permissions for su and busybox and then remount the system partition as read-only again.
Code:
> adb shell
# chmod 4755 /system/bin/busybox
# chmod 4755 /system/bin/su
# mount -o remount,ro -t rfs /dev/block/stl9 /system
# exit
That should be all. Try a reboot and some apps which require root, like Titanium Backup. The Superuser.apk should popup a dialog requesting permission.
Hope this helps. Happy rooting.
[update]
This process worked for JMA and JMD as well.
"adb install" Superuser.apk instead of "adb push"
[/update]
It will help me !
Merci ;-)
Fantastic! This is just what I was looking for, thank you! I feel dumb now, because I started a thread of my own right as you posted this. You must just type faster than me
I ran a quick test, and it all looks good. One quick question actually. Why do you mount like this:
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
When most instructions for the Galaxy Tab have you doing something like this:
Code:
# mount -o remount,rw -t rfs /dev/block/stl9 /system
I'm not saying it is wrong, in fact, it actually worked for me. I'm just curious as to why it works like that? My understanding of mounting partitions and such in Linux is a little bit weak, so I like to indulge my curiousity by bugging fine people like yourself
Anyway, thanks again, this did exactly what I needed it to. Well done, I appreciate it.
DavidThompson256 said:
One quick question actually. Why do you mount like this:
Code:
# mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system
When most instructions for the Galaxy Tab have you doing something like this:
Code:
# mount -o remount,rw -t rfs /dev/block/stl9 /system
I'm not saying it is wrong, in fact, it actually worked for me. I'm just curious as to why it works like that? My understanding of mounting partitions and such in Linux is a little bit weak, so I like to indulge my curiousity by bugging fine people like yourself
Click to expand...
Click to collapse
Thanks for pointing that out! Actually both the filesystem type and blockdevice name were totally wrong. Apparently the mount command ignores both parameters - at least when they are wrong.
I just verified this as self-punishment for not paying attention:
Code:
# mount
(...)
/dev/block/stl9 /system rfs ro,relatime,vfat,log_off,check=no,gid/uid/rwx,iocharset=utf8 0 0
(...)
/system is mounted read-only to /dev/block/stl9. This is the normal state of things.
Now I remount this without the fstype parameter and using a wrong blockdevice name:
Code:
# mount -o remount,rw /dev/block/xyz /system
# mount
(...)
/dev/block/stl9 /system rfs rw,relatime,vfat,llw,check=no,gid/uid/rwx,iocharset=utf8 0 0
(...)
Surprise, this actually remounts /system in read-write mode. This is why my original howto worked despite using the wrong parameters.
Thanks again. I corrected the HOWTO.
It works for me, but i get now error message: The application calendar save (proces com.android.providers.calendar) is unexpecly stopt. Try again. Forced closing
I had this also with SuperOneClick.
When i want to start the calender in the applications i get it also.
The application wil not run anymore.
How can i resolved this.
Thnx
leonreijnders said:
It works for me, but i get now error message: The application calendar save (proces com.android.providers.calendar) is unexpecly stopt. Try again. Forced closing
I had this also with SuperOneClick.
When i want to start the calender in the applications i get it also.
The application wil not run anymore.
How can i resolved this.
Thnx
Click to expand...
Click to collapse
That is strange. The result of the rooting process is just adding three files to the system partition. I find it hard to believe that this could lead to the problem you describe. However, while experimenting with z4root I had the the effect that there were many rageagainstthecage processes running in the background and the Galaxy Tab slowed down considerably. Perhaps there is something similar going on.
Have you tried rebooting after completing the rooting process?
Try shutting down the Tab completely.After rebooting get a shell on the Tab with "adb shell" and execute "ps". That shows the process list. If that looks normal, I would try a factory reset of the device. Which ROM version are you running?
BlackLevel: Thank you soooooooooo much... I don't get how to hit the Thanks Meter thing, but here is the old fashioned way. I used a MacBook to accomplish your perfect, step by step rooting of an AT&T Galaxy Tab i987. It helps that I'm more comfortable at the command line than with most GUI systems.
I could put this into a bash script, but that could be dangerous. People really need to look at whats happening with 'adb' and have some idea of what adb is for. I did renamed your 'adbmac' to 'adb', then I could cut and paste from your instructions except for adding ./ before the adb... ie. ./adb shell
Again, wonderful work at pulling this all together in one place.
Jeff
This guide worked perfectly! I love a nice quiet clean root and it doesn't get any better than this. You my friend deserve a cookie!
Hi Guys,
I flashed to JMA, rooted it with One Click Root, and everxthing seemdet to be okay, but activating OCLF failed....is there anybody with the same problem?
Jan
Thanks a lot !. It's clean and doesn't need a kies ...
Just a question : after reboot I have to use "su" after "adb shell" to become root.
Is there any way to be root directly after adb shell ?
And thanks again ...
Mike
mbaroukh said:
Just a question : after reboot I have to use "su" after "adb shell" to become root.
Is there any way to be root directly after adb shell ?
Click to expand...
Click to collapse
The reason is that "/sbin/adbd" (the adb daemon) is running as the shell user. It would need to run as root user instead. This requires changes to the initial ram disk where adbd the relevant settings are stored.
Dealing with "insufficient permissions for device"
Thanks, this worked for me.
One small thing: running from a Linux sustem (Ubuntu 9.04), to overcome a "insufficient permissions for device" problem, I had to put my Ubuntu terminal session into su mode and restart the ADB server -- cf. groups.google.com /group/android-discuss/browse_thread/thread/f85a795644e65b59?pli=1 :
[[
adb kill-server
sudo adb start-server
adb devices
]]
gklyne said:
One small thing: running from a Linux sustem (Ubuntu 9.04), to overcome a "insufficient permissions for device" problem, I had to put my Ubuntu terminal session into su mode and restart the ADB server -- cf. groups.google.com /group/android-discuss/browse_thread/thread/f85a795644e65b59?pli=1 :
[[
adb kill-server
sudo adb start-server
adb devices
]]
Click to expand...
Click to collapse
Thanks for the feedback. On my Ubuntu 10.10 adb runs under my regular user-id (1000) and I do not have to use sudo or run the local adb server as root. That might be due to the way the udev rules are set up. Mine are rather unrestrictive and look like this:
Code:
$ cat /etc/udev/rules.d/51-android.rules
SUBSYSTEMS=="usb", SYSFS{idVendor}=="0bb4", MODE="0666"
SUBSYSTEMS=="usb", SYSFS{idVendor}=="04e8", MODE="0666"
How do yours look like?
Which is the more simple method for root of galaxy tab euro ?are there ?
the incredible said:
Which is the more simple method for root of galaxy tab euro ?are there ?
Click to expand...
Click to collapse
Try z4root or SuperOneClick. Both methods are wrappers of the rageagainstthecage exploit and try to automate the manual process outlined here.
This thread should be a sticky. Worked like a charm.
z4root is very simple method..thanks.
thanks to Germany...
I agree, this thread should be sticky. Finaly some sense in android devel section...
Thank you very much for your guide!
I followed all the instructions in your guide, everything seems fine until I try to push the busybox and su to my Galaxy Tab.
blacklevel said:
Now we push busybox and su via adb. Then we install Superuser.apk.
Code:
> adb push busybox /system/bin
> adb push su /system/bin
> adb install Superuser.apk
[/update]
Click to expand...
Click to collapse
I received an error: "failed to copy 'busybox' to '/system/bin/busybox' : No space left on device\"
the same error for the 'su' too
(No space left on device) is impossible, my tab is brand new sealed when i got it.
I have been trying the z4root and SuperOneClick procedure to root this tab but are all unsuccessful.
I am not sure if it is because of my tab needed a "NAND unlock" (I cannot find any guide about the NAND unlock) because I received this message when I tried to install busybox from the market.
Please help! My tab is carrier locked to Bell Canada, I really wanna to unlock it and root it~
Thanks!
gummo6869 said:
I received an error: "failed to copy 'busybox' to '/system/bin/busybox' : No space left on device\"
the same error for the 'su' too,
Click to expand...
Click to collapse
The `no space left on device` message indicates that the /system partition is still read-only. That means the mount command in step 3 was unsuccessful. Did you get any error message when you executed it?
[Acer _AV041_A100_1.037.00_ww_gen1]
root
Can be successfully？？？
alexsec said:
[Acer _AV041_A100_1.037.00_ww_gen1]
root
Can be successfully？？？
Click to expand...
Click to collapse
ZN's method still works just fine.
http://forum.xda-developers.com/showthread.php?t=1531646
i can't root!
i can't root!
Verify the device is showing under the device manager, usb debugging is turned on, and that it is being run as administrator.
What OS are you using?
i have the same problem. Can't root after the recent update. using W7, executing it with and without administrator rights. Executing with administrator rights it says something of ADB.
alexsec said:
i can't root!
Click to expand...
Click to collapse
Updating script. Try once again.
rooted!! thanks!!
How to Updating script. Try once again.
@ ZeroNull, can you confirm whether ICS_rooting_A10x_A5xx works for the latest build?
Build number
Acer_A100_2.001.01_COM_GEN2
I have been unsuccessful so far:
==========================================
Preparation is finished.
-
Executing of the main script.
remote object '/system/bin/su' does not exist
The file "su" isn't created!
-
Not getting root!
-
Error!
I can confirm that I successfully rooted my A100 using ZeroNull's simple method (http://forum.xda-developers.com/showthread.php?t=1531646)
Build number: Acer_AV041_A100_1.037.00_WW_GEN1
I didn't even use the new script, I'm still using the old one (ICS_rooting.zip)
Unfortunately I can also confirm problems with recent updates of the SuperUser APK (It did not assign the correct Group ID), but apparently they were fixed in the latest update (v3.1.3)
Good Luck.
---------- Post added at 10:30 AM ---------- Previous post was at 10:05 AM ----------
alexsec said:
i can't root!
Click to expand...
Click to collapse
alexsec said:
How to Updating script. Try once again.
Click to expand...
Click to collapse
Hi alexsec, did you try with the new script, it creates a different directory than the old script did, and it uses the mkdir -p option so it creates any parent directories it needs:
Code:
adb shell "mkdir -p /data/local/tmp"
adb push tools /data/local/tmp
adb shell "chmod 0755 /data/local/tmp/mempodroid"
And it does a better job by waiting longer for the tablet to reboot:
Code:
rem Wait reboot tablet
for /L %%i in (1,1,7000000) do @rem
I even modify the getroot.sh script just to change back to the old su command and modify its permissions:
Code:
cd /data/local/tmp
echo >/data/local.prop
toolbox mount -o remount, rw /system/
cat su >/system/bin/su
ln -s /system/bin/su /system/xbin/su
chmod 06755 /system/bin/su
sync ; sync ; sync
reboot
Good Luck...
Hey all,
I was trying to push nano to my phone and I get this:
C:\>adb push nano /system/bin
failed to copy 'nano' to '/system/bin/nano': Read-only file system
Trying remount:
C:\>adb remount
remount failed: Operation not permitted
Then from ADB shell, I try:
c:\>adb shell
[email protected]:/ $ su
su
[email protected]:/ # mount -o rw,remount /system
mount -o rw,remount /system
[email protected]:/ #
[email protected]:/ # exit
exit
[email protected]:/ $ exit
exit
c:\>adb push nano /system/bin
failed to copy 'nano' to '/system/bin/nano': Permission denied
Any ideas? I'm rooted the superuser and busybox installed.
I rooted using this method:
http://forum.xda-developers.com/showthread.php?t=1956432
Apps get elevated privileges without error. Terminal emulator allows me to view system files. Unfortunately I need to edit some program files in /data/data and there doesn't seem to be any editor available (vi is acting very glitchy). I discovered this problem when I tried to push nano to my phone.
I also tried to access /data using gEditor and it says:
file list
/data
cannot change the directory.
Something is very wrong here. Do I need to re-root using a different method? Please advise. Thanks!
Update: I was able to get adb to work. It turns out I never flashed an unsecured boot image.
However, my nano installation doesn't work and gEditor crashes when I try to access the data folder. That will be for another thread.
For remount and push/pull commands to work, download adbd insecure from playstore . That's the only way you will be able to do the aforementioned commands.
Thanks for the tip. After rerooting the phone with an unsecured image I was able to use adb. I am able to use adb right now without adbd installed however.
Sent from my SGH-T889 using xda app-developers app
I was going crazy allover looking for an answer, and found it here...
Thanks.
Not compatible
teshxx said:
For remount and push/pull commands to work, download adbd insecure from playstore . That's the only way you will be able to do the aforementioned commands.
Click to expand...
Click to collapse
Is there any other option?? That software is not compatible with my android!!
You will have to flash a kernel which has adb secure set to 0.
Sent from my SGH-T889 using xda app-developers app
At first I thought it was maybe because I didnt'nt have enough free space on my sd card so I made sure I had 3GB's free but I still got this when I clicked install:
[13:04:26] Updating configuration file ... done
[13:04:27] >>> begin: install
[13:04:27] Checking mount points ... done
[13:04:27] Checking installation path ... done
[13:04:27] Making new disk image (512 MB) ... fail
[13:04:27] <<< end: install
And this when I try to reconfigure:
[13:02:49] Updating configuration file ... done
[13:02:50] >>> begin: configure
[13:02:50] Mounting partitions:
[13:02:50] / ... fail
[13:02:50] <<< end: configure
When I check my root stutus I get this message:
Congratulations! You have root access!
Super User Application Status:
SuperSU application by Chainfire - version 2.36 - is installed!
System File Properties for Root Access:
Standard Location
Check Command: ls -l /system/bin/su:
Result: /system/bin/su: No such file or directory
Analysis: File /system/bin/su does not exist.
Standard Location
Check Command: ls -l /system/xbin/su:
Result: -rwxr-xr-x root root 71264 2014-11-30 16:22 su
Analysis: Root access IS correctly configured for this file! Executing this file can grant root access! Root user ownership is present and setuid attribute is not present.
Alternative Location
Check Command: ls -l /sbin/su:
Result: /sbin/su: Permission denied
Analysis: File system permissions restricted and denied access.
Alternative Location
Check Command: ls -l /system/xbin/sudo:
Result: /system/xbin/sudo: No such file or directory
Analysis: File /system/xbin/sudo does not exist.
Root User ID and Group ID Status:
Root user id:
uid=0(root)
Root group id:
gid=0(root)
System Environment PATH: /sbin /vendor/bin /system/sbin /system/bin /system/xbin
ADB Shell Default User:
ADB shell setting for standard access, stored in default.prop, is configured as: shell (non root) user - ro.secure=1
Results provided on your SM-T800 - Android 4.4.2 device by Root Checker Pro version 1.3.9 from joeykrim in the Android Market
Can anybody tell me why I get this fail message after clicking install?i
Please help
Thank You
AO!
Same issue
Im currently having the same issue with trying to install kali on my tab s. Have root and even sd formated to ext4 but still issues .
Check your SE(Linux) status on Settings / About Device. If it says Enforcing then this is the cause of the problem.
You need to change it to permissive, but you can't do it on a stock rom. You need a kernel with permissive mode
enable or a custom rom with a permissive kernel.
Good Luck
eupeso4 is wrong. You don't need a different kernel. There is an app called SELinuxModeChanger... It works charms
I've attached the app below.
soulcrusher101 said:
eupeso4 is wrong. You don't need a different kernel. There is an app called SELinuxModeChanger... It works charms
I've attached the app below.
Click to expand...
Click to collapse
Also, go to terminal emulator after this.
Code:
su
getenforce
If you get "Enforcing" as a response, it's FUBAR. you can try to run the command "setenforce 0" as su as a workaround but if the app didn't work, it won't likely work either.
Molikai1988 said:
Also, go to terminal emulator after this.
Code:
su
getenforce
If you get "Enforcing" as a response, it's FUBAR. you can try to run the command "setenforce 0" as su as a workaround but if the app didn't work, it won't likely work either.
Click to expand...
Click to collapse
Okay i got enforcing. my deviceis SC-04E thats is S4 (docomo). i want to set SE Linux to premissive tell me the solution
soulcrusher101 said:
eupeso4 is wrong. You don't need a different kernel. There is an app called SELinuxModeChanger... It works charms
I've attached the app below.
Click to expand...
Click to collapse
Doesn't work on stock kernels.
I tried everything. But it doesn't work even after changing the SELinux to permissive., But after searching a lot, I found a thread which said me to change the partition to ext2. I changed the partition and then it all worked like charm.., If you still have issues, follow the guide in this link from start to end-https://github.com/meefik/linuxdeploy/issues/183, This solved most of the issues I had..
Linux Deploy Mounting Partitions Fail
Bro problem solved by me..
Check out this video
https://youtu.be/n5opus76c3k
I tried to find anyone with a similar issue to no avail so I'm not sure if anyone will be able to help me but basically everything works fine fastboot and adb and according to the root checker I'm fully rooted. But whenever I use
adb shell su -c "dd if=/dev/block/mmcblk0boot0 of=/sdcard/boot0block.img"
or the other backup commands all that comes up is exec: no such file or directory.
Is there something I'm missing or maybe something I overlooked or didnt install properly? Hope it's an easy fix. Thanks in advance.
I had same error
Detrimantix said:
I tried to find anyone with a similar issue to no avail so I'm not sure if anyone will be able to help me but basically everything works fine fastboot and adb and according to the root checker I'm fully rooted. But whenever I use
adb shell su -c "dd if=/dev/block/mmcblk0boot0 of=/sdcard/boot0block.img"
or the other backup commands all that comes up is exec: no such file or directory.
Is there something I'm missing or maybe something I overlooked or didnt install properly? Hope it's an easy fix. Thanks in advance.
Click to expand...
Click to collapse
introduce without the quotes. For example: adb shell su -c dd if=/dev/block/mmcblk0boot0 of=/sdcard/boot0block.img